Description
Use after free in GPU in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Published: 2026-09-29
Score: 9.6 Critical
EPSS: n/a
KEV: No
Impact: Remote code execution
Action: Immediate patch
AI Analysis

Impact

A use‑after‑free bug in the GPU subsystem of Google Chrome can be triggered by a crafted HTML page, allowing a remote attacker to execute arbitrary code outside the browser sandbox. The flaw is the classic CWE‑416 weakness and carries a CVSS score of 9.6, indicating a severe vulnerability that can compromise confidentiality, integrity, and availability of the host system.

Affected Systems

The issue affects Google Chrome desktop releases older than 154.0.8037.57. Users running any pre‑154 version are vulnerable, regardless of operating system, as the fault lies in the browser’s GPU processing code.

Risk and Exploitability

The CVSS score of 9.6 reflects the high exploitation potential and broad impact of this bug. Although no EPSS data is reported, the absence of a KEV listing does not diminish the likelihood of exploitation by attackers who construct malicious HTML content. Attackers would likely deliver the payload via a web page accessed from a remote host; the vulnerability is exploitable in a purely client‑side context, making it convenient for widespread attacks.

Generated by OpenCVE AI on September 29, 2026 at 22:19 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Chrome update that includes the GPU use‑after‑free fix, which is available in the 154.0.8037.57 release and later.
  • If an immediate update is not feasible, temporarily disable hardware acceleration via the Chrome Settings → Advanced → System panel, which removes the vulnerable GPU path from rendering paths.
  • As an additional defense, restrict execution of untrusted web content by employing a content‑security‑policy that limits the use of WebGL, Canvas, and other GPU‑dependent features until the patch is deployed.

Generated by OpenCVE AI on September 29, 2026 at 22:19 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6513-1 chromium security update
History

Tue, 29 Sep 2026 22:45:00 +0000

Type Values Removed Values Added
Title GPU Use-After-Use Enables Remote Code Execution in Chrome via Malicious HTML

Tue, 29 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 29 Sep 2026 17:45:00 +0000

Type Values Removed Values Added
Description Use after free in GPU in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Weaknesses CWE-416
References

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-09-29T19:31:25.516Z

Reserved: 2026-09-22T05:07:52.475Z

Link: CVE-2026-95299

cve-icon Vulnrichment

Updated: 2026-09-29T19:25:21.794Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-29T18:17:21.837

Modified: 2026-09-29T20:17:29.647

Link: CVE-2026-95299

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-29T22:30:19Z

Weaknesses